The Certificate Is On the Wall. Now the Controls Start to Drift.

There is a specific moment, roughly a fortnight after certification, when Cyber Essentials stops being a project and becomes a thing on the wall. The assessment is done. The invoice is paid. Somebody in marketing has added a logo to the website footer.

And then everyone goes back to work, and the controls very slowly stop being true.

This is not a criticism of Cyber Essentials, which remains one of the better-value things a small UK organisation can do. It is a criticism of what we tend to do next, which is to treat a point-in-time snapshot as if it were a permanent condition.

What the assessor actually saw

An assessor sees a version of your organisation on a particular day, described by the evidence you chose to show them. That is the deal, and it is a fair one. But it means the certificate is a statement about a moment, not a guarantee about a year.

In the months afterwards, small things happen. A new starter gets a laptop and, because the standard build was slow, gets local admin 'just for now'. A marketing freelancer is given access to the shared drive and nobody revisits it when the campaign ends. Someone buys a cheap SaaS tool on a company card because it solved a problem on a Friday afternoon, and it never appears in any asset list.

Each of those is individually trivial. Together, they are how a certified organisation quietly stops matching its own paperwork.

Evidence has a shelf life

Most of the work of staying certified is not technical. It is administrative discipline, and it is dull enough that it always slides.

Screenshots from a settings page become wrong the moment the settings change. A patching report from February does not describe November. The firewall rule you documented has been edited twice since, by two different people, neither of whom wrote it down.

A simple habit fixes most of this: whenever you change something that appears in your evidence pack, replace the evidence in the same week. Not at renewal. Not when the assessor asks. Straight away, while the person who made the change still remembers why.

Keep the evidence in one folder with the date in every filename. Six months from now, the difference between 'we think we did this' and 'here is the export from the 14th' is the difference between a calm renewal and a fortnight of archaeology.

Retest the assumptions you made in a hurry

Every certification push involves at least one decision made under time pressure. A device was excluded from scope. A legacy server was judged out of bounds. A cloud service was assumed to be covered by the provider's own certifications.

Six months later, go back and ask whether those calls still hold. The legacy server may now hold client data. The excluded devices may be the ones handling payroll. That cloud service may have moved from 'a nice tool' to 'the place where all our work lives'.

You are not looking for someone to blame. You are looking for the places where the written scope and the real business have drifted apart, because that is exactly where an incident will eventually be awkward.

Scope is a moving target, not a document

Businesses change shape without announcing it. A new office, a hybrid arrangement that puts company laptops in kitchens, a first acquisition, a shift from on-premise file storage to a cloud suite, a contractor who needs a login for three weeks and keeps it for three months.

Any of those can push something into scope that your original assessment never considered. The fix is not a full reassessment every time — it is a short, honest review of the scope document at a fixed point in the year, plus a rule that significant changes get flagged at the time.

A useful question to ask quarterly: what do we have now that we did not have when we were assessed? The answers are usually more interesting than expected.

The drift nobody logs

The failures that creep in after certification tend to be unglamorous and human.

Multi-factor authentication still exists, but two accounts have permanent exceptions because someone found the app annoying. Patching still happens, but the cadence has slipped from fourteen days to whenever the engineer has a quiet Friday. The admin account count has quietly doubled. The offboarding checklist exists but is stored somewhere nobody opens during a busy week.

None of this shows up on a certificate. All of it shows up in an incident.

The first six months after the certificate

If you do nothing else, do these four things.

Make one person responsible for the evidence folder and give them a recurring 30-minute slot each month, not a heroic week each year. Re-read the scope document against the current asset list and note every difference. Pick two controls you know are weakest — usually patching and joiners-movers-leavers — and test them by sampling rather than assuming. Then write a one-page summary for whoever signs off on risk, so the certificate is understood as a baseline and not as a finish line.

Don't let the badge become the programme

Cyber Essentials tells you that a set of foundational controls were in place on the day someone looked. That is worth having, particularly for smaller teams who need a starting structure and a conversation with insurers that does not begin with a blank page.

But a certificate is a floor. It is not a security programme, and it will not notice when your business changes underneath it.

The organisations that get real value from certification are not the ones with the shiniest badge. They are the ones who keep asking, quietly and repeatedly, whether the thing on the wall is still true.